orcus | 8667faa80b6d3e4126e5e9e60b6e2f755f5388c5554e7b6fd59bcd5a342326ad

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Orcus.exe

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Orcus.exe

Orcurs Rat Executable 1 IoCs

resource	yara_rule
behavioral1/memory/3964-199-0x000000001E230000-0x000000001E532000-memory.dmp	orcus

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	Orcus.exe

Executes dropped EXE 2 IoCs

pid	Process
2744	WindowsInput.exe
3936	WindowsInput.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

defense_evasion persistence privilege_escalation

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1188	powershell.exe
4656	powershell.exe
2596	powershell.exe
3632	powershell.exe
3304	powershell.exe
4284	powershell.exe
960	powershell.exe
4468	powershell.exe
460	powershell.exe
1396	powershell.exe
4124	powershell.exe

Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 1 IoCs

Possible Turn off User Account Control's privilege elevation for standard users.

Executable Installer File Permissions Weakness

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	Orcus.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsInput.exe	Orcus.exe
File created	C:\Windows\SysWOW64\WindowsInput.exe.config	Orcus.exe
File created	C:\Windows\SysWOW64\WindowsInput.InstallState	WindowsInput.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Windows\MpDefenderCore.exe	Orcus.exe
File created	C:\Program Files\Windows\MpDefenderCore.exe.config	Orcus.exe
File opened for modification	C:\Program Files\Windows\MpDefenderCore.exe	Orcus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4268	powershell.exe
4268	powershell.exe
3632	powershell.exe
460	powershell.exe
3632	powershell.exe
1396	powershell.exe
3304	powershell.exe
3304	powershell.exe
4124	powershell.exe
4124	powershell.exe
4284	powershell.exe
4284	powershell.exe
4656	powershell.exe
4656	powershell.exe
1188	powershell.exe
1188	powershell.exe
960	powershell.exe
960	powershell.exe
4468	powershell.exe
4468	powershell.exe
2596	powershell.exe
2596	powershell.exe
460	powershell.exe
460	powershell.exe
1396	powershell.exe
1396	powershell.exe
2596	powershell.exe
3304	powershell.exe
4124	powershell.exe
4284	powershell.exe
4656	powershell.exe
4468	powershell.exe
960	powershell.exe
1188	powershell.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2664	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4268	powershell.exe
Token: SeIncreaseQuotaPrivilege	4268	powershell.exe
Token: SeSecurityPrivilege	4268	powershell.exe
Token: SeTakeOwnershipPrivilege	4268	powershell.exe
Token: SeLoadDriverPrivilege	4268	powershell.exe
Token: SeSystemProfilePrivilege	4268	powershell.exe
Token: SeSystemtimePrivilege	4268	powershell.exe
Token: SeProfSingleProcessPrivilege	4268	powershell.exe
Token: SeIncBasePriorityPrivilege	4268	powershell.exe
Token: SeCreatePagefilePrivilege	4268	powershell.exe
Token: SeBackupPrivilege	4268	powershell.exe
Token: SeRestorePrivilege	4268	powershell.exe
Token: SeShutdownPrivilege	4268	powershell.exe
Token: SeDebugPrivilege	4268	powershell.exe
Token: SeSystemEnvironmentPrivilege	4268	powershell.exe
Token: SeRemoteShutdownPrivilege	4268	powershell.exe
Token: SeUndockPrivilege	4268	powershell.exe
Token: SeManageVolumePrivilege	4268	powershell.exe
Token: 33	4268	powershell.exe
Token: 34	4268	powershell.exe
Token: 35	4268	powershell.exe
Token: 36	4268	powershell.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	460	powershell.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	4284	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	1188	powershell.exe
Token: SeDebugPrivilege	960	powershell.exe
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeIncreaseQuotaPrivilege	3632	powershell.exe
Token: SeSecurityPrivilege	3632	powershell.exe
Token: SeTakeOwnershipPrivilege	3632	powershell.exe
Token: SeLoadDriverPrivilege	3632	powershell.exe
Token: SeSystemProfilePrivilege	3632	powershell.exe
Token: SeSystemtimePrivilege	3632	powershell.exe
Token: SeProfSingleProcessPrivilege	3632	powershell.exe
Token: SeIncBasePriorityPrivilege	3632	powershell.exe
Token: SeCreatePagefilePrivilege	3632	powershell.exe
Token: SeBackupPrivilege	3632	powershell.exe
Token: SeRestorePrivilege	3632	powershell.exe
Token: SeShutdownPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeSystemEnvironmentPrivilege	3632	powershell.exe
Token: SeRemoteShutdownPrivilege	3632	powershell.exe
Token: SeUndockPrivilege	3632	powershell.exe
Token: SeManageVolumePrivilege	3632	powershell.exe
Token: 33	3632	powershell.exe
Token: 34	3632	powershell.exe
Token: 35	3632	powershell.exe
Token: 36	3632	powershell.exe
Token: SeIncreaseQuotaPrivilege	460	powershell.exe
Token: SeSecurityPrivilege	460	powershell.exe
Token: SeTakeOwnershipPrivilege	460	powershell.exe
Token: SeLoadDriverPrivilege	460	powershell.exe
Token: SeSystemProfilePrivilege	460	powershell.exe
Token: SeSystemtimePrivilege	460	powershell.exe
Token: SeProfSingleProcessPrivilege	460	powershell.exe
Token: SeIncBasePriorityPrivilege	460	powershell.exe
Token: SeCreatePagefilePrivilege	460	powershell.exe
Token: SeBackupPrivilege	460	powershell.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe

Suspicious use of SendNotifyMessage 53 IoCs

pid	Process
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe
2664	taskmgr.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 4060	3964	Orcus.exe	81
PID 3964 wrote to memory of 4060	3964	Orcus.exe	81
PID 4060 wrote to memory of 652	4060	csc.exe	83
PID 4060 wrote to memory of 652	4060	csc.exe	83
PID 3964 wrote to memory of 2744	3964	Orcus.exe	84
PID 3964 wrote to memory of 2744	3964	Orcus.exe	84
PID 3964 wrote to memory of 4268	3964	Orcus.exe	86
PID 3964 wrote to memory of 4268	3964	Orcus.exe	86
PID 3964 wrote to memory of 460	3964	Orcus.exe	89
PID 3964 wrote to memory of 460	3964	Orcus.exe	89
PID 3964 wrote to memory of 3632	3964	Orcus.exe	91
PID 3964 wrote to memory of 3632	3964	Orcus.exe	91
PID 3964 wrote to memory of 1396	3964	Orcus.exe	93
PID 3964 wrote to memory of 1396	3964	Orcus.exe	93
PID 3964 wrote to memory of 3304	3964	Orcus.exe	95
PID 3964 wrote to memory of 3304	3964	Orcus.exe	95
PID 3964 wrote to memory of 4284	3964	Orcus.exe	97
PID 3964 wrote to memory of 4284	3964	Orcus.exe	97
PID 3964 wrote to memory of 4124	3964	Orcus.exe	98
PID 3964 wrote to memory of 4124	3964	Orcus.exe	98
PID 3964 wrote to memory of 1188	3964	Orcus.exe	101
PID 3964 wrote to memory of 1188	3964	Orcus.exe	101
PID 3964 wrote to memory of 960	3964	Orcus.exe	103
PID 3964 wrote to memory of 960	3964	Orcus.exe	103
PID 3964 wrote to memory of 4656	3964	Orcus.exe	105
PID 3964 wrote to memory of 4656	3964	Orcus.exe	105
PID 3964 wrote to memory of 4468	3964	Orcus.exe	107
PID 3964 wrote to memory of 4468	3964	Orcus.exe	107
PID 3964 wrote to memory of 2596	3964	Orcus.exe	109
PID 3964 wrote to memory of 2596	3964	Orcus.exe	109

System policy modification 1 TTPs 7 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	Orcus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Orcus.exe

C:\Users\Admin\AppData\Local\Temp\Orcus.exe
"C:\Users\Admin\AppData\Local\Temp\Orcus.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3964
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\_udxjai8.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C57.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6C56.tmp"
    3⤵
    PID:652
- C:\Windows\SysWOW64\WindowsInput.exe
  "C:\Windows\SysWOW64\WindowsInput.exe" --install
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2596

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe"
1⤵
- Executes dropped EXE
PID:3936

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2664

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3196

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ZXRNENRX-20241023-1428a.log
1⤵
PID:4404

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ZXRNENRX-20241023-1428a.log
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:3064

C:\Users\Admin\AppData\Local\Temp\Orcus.exe
"C:\Users\Admin\AppData\Local\Temp\Orcus.exe"
1⤵
PID:1356
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jeld1fki.cmdline"
  2⤵
  PID:1760
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESECAE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEC9D.tmp"
    3⤵
    PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery